Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Why Inline asm in C++/CLI creates horrible problem?

Topic created on: August 20, 2010 12:09 CDT by Usman .

Hello,

I am extremely begginer and at at most novice level for playing with assembly.

I am using Inline asm in C++/CLI. Horrible problem infact could be a bug I obsereved. I passed vector from one function call to another. If I comment the whole code snippet of _asm{....some assembly code here} inside the called function where vector used which are provided to it from other function, then no problem whole vector gets fine and copied to argument of called function successfully in correct manner.

But If uncomment _asm{} I mean if I use _asm{} patch in called function , it corrupts the whole vectors of objects, even single string which is participating as in parameter to the function .Infact every most of arguments as data of called function get corrupts where _asm code used. It just shows for every argument values like npos=4294967295. I was expecting string argument would contain valid "strings" and all other rest of parameter would have their correct states. which I just passed from other functions to that called function.


I am amazed while debugging the exe that even before reaching to the point of "_asm" at code , whole data before "_asm" place gets corrupts. Its just like unbelieveable.

EVEN IF I COMMENT EVERYTHING INSIDE _asm PATCH, AND HAVING JUST _asm{} EMPTY OPENING CLOSING BRACES AFTER _asm KEYWORD, STILL THE PROBLEM HAPPENS

Here If I dont write anything at all inside _asm{} even then problem occurs which I described.

What is it? Why this is so? Is CLI creating problem or I am using inline asm in wrong way?
Do I need to save the states of registers?

Kindly help me out , as I am stuck here.

example code:

strParamType  = strReturnType;
               if(strParamType.find("IDispatch")!=string::npos)
             {
                 IDispatch* pIDispatch;
                 _asm
                 {
                   mov  esi,esp
                       lea  eax,[pIDispatch]
                   push eax
             }
              }



Regards
Usman

  jduck     August 20, 2010 13:19.54 CDT
You should refrain from modifying the stack (push eax) when using inline assembly. Otherwise, everything will get horribly messed up.

  Usman     August 20, 2010 18:07.39 CDT
I said not even pushing anything ,just introducing block of _asm{} messed up.

I have to use _asm in my code at every cost. Then What should be the solution to this problem, Do anything extra I need to do for using _asm in my code? How peaople then use _asm in C++ as inline as I am stuck here ?

  RabidCicada     August 23, 2010 11:20.27 CDT
I'd say to look at the generated code and find the difference between the assembly generated by the two (with/without empty asm block).

If you are using MSVC then debug it and stop at the very beginning then right click->view assembly for the code.  It'll show you the assembly for all the C++ code you have and you'll see the assembly it's generating for your code.

  ronnie291983     August 25, 2010 03:54.28 CDT
i generally use pusha/pushf to keep the flags and registers intact and then do what ever u need with the assessmbly after that do a popf/a

Note: Registration is required to post to the forums.

There are 28,224 total registered users.


Recently Created Topics
Reverse Engineering ...
Jan/23
Career: DoD Agency I...
Jan/22
"Disappearing&q...
Jan/17
Career: Software Sec...
Jan/11
Where is the call st...
Jan/07
IDA Pro 6.1 Breakpoi...
Jan/01
How to create data s...
Dec/30
can i search all mod...
Dec/23
IDA symbol table exp...
Dec/20
An anti-attach trick
Dec/17


Recent Forum Posts
Reverse Engineering ...
NirIzr
"Disappearing&q...
NirIzr
Reverse Engineering ...
charlie
"Disappearing&q...
charlie
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
Looking for value in...
NirIzr


Recent Blog Entries
cmathieu
Feb/07
Hacker Carnival

waleedassar
Feb/06
OllyDbg v1.10 And Hardware ...

waleedassar
Jan/31
Yet Another Anti-Debug Trick

RolfRolles
Jan/22
Finding Bugs in VMs with a ...

waleedassar
Jan/13
An OllyDbg Bug Disables Sof...

More ...


Recent Blog Comments
waleedassar on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/05
Yet Another Anti-Debug Trick

trolotou on:
Feb/05
Doudoune Moncler -Pennies F...

waleedassar on:
Feb/01
Yet Another Anti-Debug Trick

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit